Mmakeplane

Products

Exploited and recent CVEs

• CVE-2026-111869 Medium 5.3 makeplane API Endpoint reliance on untrusted inputs in a security decision 0.5%
• CVE-2026-102980 Medium 6.5 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope 0.4%
• CVE-2026-102985 Medium 6.5 Plane: Any project member can modify (deactivate) other members' records 0.3%
• CVE-2026-102986 High 8.1 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/ 0.5%
• CVE-2026-102981 Medium 6.5 Plane: Unauthenticated Workspace Invitation Token Leakage 0.2%
• CVE-2026-102982 High 8.5 Plane: XSS in work item comments 0.4%
• CVE-2026-102988 Medium 5.3 Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) 0.3%
• CVE-2026-105641 Critical 9.8 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass 0.5%
• CVE-2026-105640 Critical 9.1 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) 0.4%
• CVE-2026-105639 Critical 9.8 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane 0.4%
• CVE-2026-105638 Critical 9.1 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force 0.4%
• CVE-2026-105637 Critical 9.6 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) 0.3%
• CVE-2026-105636 Critical 9.9 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set) 0.4%
• CVE-2026-105635 High 7.4 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token 0.4%
• CVE-2026-105634 High 8.1 Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles 0.3%
• CVE-2026-105633 High 7.1 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope 0.3%
• CVE-2026-105632 High 8.7 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects 0.3%
• CVE-2026-105631 High 7.5 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure 0.3%
• CVE-2026-105630 High 8.7 Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) 0.2%
• CVE-2026-105629 High 7.1 Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup 0.2%
• CVE-2026-105628 High 7.6 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint 0.3%
• CVE-2026-104979 High 8.7 Plane: Cross-tenant stored XSS in intake enables account takeover 0.4%
• CVE-2026-104978 High 8.2 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance 0.4%
• CVE-2026-104977 High 7.7 Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU 0.3%
• CVE-2026-104976 High 8.7 Plane: SSRF in Gitea OAuth 0.2%
• CVE-2026-104975 High 7.1 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints 0.3%
• CVE-2026-104974 High 8.1 Plane: Disabled User Auto-Reactivation on Login 0.5%
• CVE-2026-104973 High 7.6 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery 0.3%
• CVE-2026-104971 High 8.5 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization 0.3%
• CVE-2026-104970 High 8.1 Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins 0.3%